Researchers have often assumed that this will be true [1]},
and argue that it is acceptable to train models with guarantees
so weak that they are essentially vacuous, hoping that the
actual privacy offered is much stronger [2]}.
This is important because training models with weak guarantees generally allows one to achieve greater model utility, which often leads practitioners to follow this train of thought when tuning their DP training algorithms.
